Subject: Re: Problems With WUFTP and BSDI

From: [email-masked] (William E. Diego)
Date: Tue, 4 Mar 1997 15:54:32 -0500

> From [email-masked] Tue Mar  4 15:49:22 1997
> Date: Tue, 4 Mar 1997 14:37:09 -0600 (CST)
> Reply-To: [email-masked]
> Sender: [email-masked]
> From: Vidiot <[email-masked]>
> To: [email-masked]
> Subject: Re: Problems With WUFTP and BSDI
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> X-Mailer: ELM [version 2.4 PL25]
> X-Listprocessor-Version: 8.0 -- ListProcessor(tm) by CREN
> <> The next problem of note is the fact that when I'm ftp'd into the secure account, ftp allows me to escape to a shell (even though the shell is setup as /etc/ftponly) and traverse the directory tree from the root on down.
> <> 
> <
> <SAY WHAT !!!!!!
> <you had a shell prompt while loggin as "ftp" ?????
> 
> For shits and grins, when I logged in as anonymous, I was able to do !sh and
> get a shell prompt.  I was then able to cd to / and do a ls -la and see
> everything there.
> 
> Oh oh... is wu-ftpd drastically broken?  It certainly looks like it.
> 
> <Even if your config files are royally screwed you should not be able
> <to escape from the chroot().
> 
> Unfortunately, I too can escape chroot().
> 
> <What version are you running ?
> 
> Beta 12
> 
> <Did you compile it, or some unknow bin on the net ?
> 
> Compiled it myself, so that isn't a problem.
> 
> NOT GOOD!!!!
> 
I can definitely confirm the (feature ?) above on Solaris 2.5.  Ouch!!!
William E. Diego
US Army Topographic Engineering Center
[email-masked]
(703) 428-6827